Put a service on your domain

A route sends a hostname on one of your Cloudflare domains, such as app.example.com, to a service on your computer, such as localhost:3000.

Connect your Cloudflare account

Open Settings ▸ Accounts ▸ Connect an Account. You can connect with:

• An API token. Teitunnel opens Cloudflare's "Create API token" page pre-filled with the permissions it needs: Cloudflare Tunnel · Edit, DNS · Edit, Zone · Read, Account Settings · Read, and for logins Access: Apps and Policies · Edit and Access: Organizations, Identity Providers, and Groups · Edit. Create it, then paste it into Teitunnel. If Cloudflare Tunnel isn't pre-selected, add it by hand.
• Your cloudflared login. If you've run cloudflared tunnel login before, Teitunnel can use that certificate.

The token is stored in your system's keychain (Keychain on macOS, Credential Manager on Windows, the Secret Service on Linux). Teitunnel then checks what it may do on each domain and shows it under Domains.

Add a route

1. Open Routes (⌘2) and choose New Route (⌘N).
2. Pick the service: a detected dev server or container, or a port or address.
3. Type the subdomain and pick the domain. Optionally restrict the route to a path.
4. Review shows exactly what will change: the tunnel for this machine (created the first time), its routes, and the DNS record. If a record Teitunnel didn't create already uses the hostname, you're asked before it's replaced.
5. Apply. Each step is checked off as it runs; if one fails, the earlier ones are undone. Teitunnel then checks the hostname end to end through Cloudflare and tells you whether it works.

Origin settings

Advanced ▸ Origin settings covers everything cloudflared can do when it talks to your service. Leave a field empty for cloudflared's default.

• HTTPS services: accept a self-signed certificate, the name on the certificate, a certificate authority file of your own, or HTTP/2.
• Requests: a different Host header (for dev servers that only answer to their own name, like some Vite and webpack setups), no chunked encoding (some WSGI servers), or a SOCKS5 proxy for TCP routes.
• Connection: timeouts and idle connections, in seconds, and no IPv4/IPv6 fallback.

Settings made in the Cloudflare dashboard are kept when you edit a route here, and ones Teitunnel doesn't show are never removed. Importing a config.yml carries its settings over, including the ones at the top of the file that apply to every route.

The route runs through this machine's connector while Teitunnel is open. To keep it running after you quit, see run modes.